How to aggregate data from CSV file in Splunk Chart?

[rus7am]

Hi guys,

I have CSV file with following structure,

TicketNumber,OpenDate
1,date1
2,date1
3,date1
4,date2
5,date3
6,date3

And I need to build bars with information on how many tickets were opened for specific date. I mean:

Date1 = 3 tickets
Date2 = 3 tickets + 1 ticket = 4 tickets
Date3 = 4 tickets + 2 tickets = 6 tickets

Is it possible?

For now I've built a graph with "how many tickets were opened in date1, date2, date3", but I need some kind of aggregation.

[martin_mueller · Accepted solution]

You can use your tickets opened per each day to accumulate that:

... | stats count by OpenDate | accum count as openTickets

Verify that your rows are sorted by date correctly before the accum.

[martin_mueller]

Great. Don't forget to mark this as solved.

[rus7am]

thanks a lot! that's works!